is being used for sending out email messages for the Cheri Craigslist dating scam. The spam is coming from the subdomain, as you can see from the headers of a sample fraudulent email message below.

Delivered-To: ***@***.***
Received: by with SMTP id s8cs74788ybi;
Thu, 11 Nov 2010 19:43:18 -0800 (PST)
Received: by with SMTP id m2mr3084169ybf.48.1289533397732;
Thu, 11 Nov 2010 19:43:17 -0800 (PST)
Received: from ([])
by with ESMTP id l55si6539186yhd.141.2010.;
Thu, 11 Nov 2010 19:43:17 -0800 (PST)
Received-SPF: fail ( domain of does not designate as permitted sender) client-ip=;
Authentication-Results:; spf=hardfail ( domain of does not designate as permitted sender)
Received: from [] (helo=3e414603b1a244c)
by with esmtpa (Exim 4.69)
(envelope-from )
id 1PGkXi-0004kH-VS
for ***@***.***; Thu, 11 Nov 2010 21:43:15 -0600
MIME-Version: 1.0
Date: Thu, 11 Nov 2010 19:43:15 -0800
X-Priority: 3 (Normal)
Subject: RE: criagslist
From: “meee ;)”
To: “***”
Content-Type: multipart/alternative;
X-Mailer: Microsoft Outlook, Build 10.0.6822
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname –
X-AntiAbuse: Original Domain –
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain –

Hey Babe, hehe you seem to be my kind of guy.

thanks for the reply. Totally honestly, i just want some no strings action today or tomorrow. You into that?

You ever do this? I’ve a couple times b4. Everytime I think about hooking up with no strings I get really horny but a little worried. I don’t want to meet some underage kid or something.

I’m a pretty upfront person so let me just lay this out before we go any further. This is a NSA thing with nothing else. I just got out of a relationship and am not looking for a guy to hold me back.

If you are good with that then there is one more thing I have for you. I am getting a lot of emails from HS kids and creepy guys out there so i am requiring everyone to register for my peace of mind. Its no cost but I promise if you do this, Ill make it worth your while and will be more open to whatever you want to do. If you dont want to do this then i am afraid we can’t go any further because it wont be any fun for me being stressed and afraid of you the whole time.

If you want to meet me still then just go here [Here there was a link to Do not visit that site!]. You can find my profile and contact information there.

I’m looking forward to seeing you

Call me at the number on there.

Bye for now


The reason that this is a scam is because the person that is supposedly sending the messages doesn’t exist. The messages are actually being sent by someone who makes money from directing you to the dating sites that you are being asked to join. These scammers like to call this “affiliate marketing”, but it is fraud.

Other servers that have been used for sending these scam messages are:

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: